Minimize Wildcard Use In Roles And Cluster Roles

kubectl get clusterroles -o json | jq -r '
  .items[]
  | select(
      .rules[]? |
      (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
    )
  | .metadata.name
'

kubectl get clusterrole example-clusterrole -o yaml > example-clusterrole.yaml

rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

rules:
- apiGroups: [""]              # core API group
  resources:
    - pods
    - services
  verbs:
    - get
    - list
    - watch

kubectl apply -f example-clusterrole.yaml

wildcards=$(kubectl get roles --all-namespaces -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l)

wildcards_clusterroles=$(kubectl get clusterroles -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l)

total=$((wildcards + wildcards_clusterroles))

if [ "$total" -gt 0 ]; then
  echo "wildcards_present"
else
  echo "no_wildcards_in_roles_or_clusterroles"
fi

#!/usr/bin/env bash
#
# Minimize wildcard use in Roles and ClusterRoles (CIS GKE 4.1.3)
#
# Scope: run on any machine with kubectl access and jq installed.
# This script is ASSISTED / SEMI-AUTOMATIC:
# - It does NOT blindly rewrite RBAC.
# - It finds Roles/ClusterRoles using wildcards, exports them, and opens them for
#   manual, least-privilege editing, then reapplies them.
#
# Idempotency:
# - Safe to re-run; it will re-check, re-export, and allow re-editing the same objects.
# - Only 'kubectl apply' is used; no deletes.
#
# OPERATIONAL NOTE:
# - Changing RBAC may immediately remove access from users/service accounts.
# - Carefully review each object and test access for affected subjects.

set -euo pipefail

# CONFIG
OUTPUT_DIR="${PWD}/rbac-wildcards-$(date +%Y%m%d-%H%M%S)"
EDITOR_CMD="${EDITOR:-vi}"   # Change to your preferred editor if desired

mkdir -p "${OUTPUT_DIR}/roles" "${OUTPUT_DIR}/clusterroles"

echo "Discovering Roles and ClusterRoles that use wildcards in rules..."

# Function: list wildcard RBAC objects in JSON
list_wildcard_objects() {
  local kind="$1"   # roles or clusterroles
  if [[ "${kind}" == "roles" ]]; then
    kubectl get roles --all-namespaces -o json
  else
    kubectl get clusterroles -o json
  fi
}

# Extract Roles with wildcards
roles_json="$(list_wildcard_objects roles || echo '{}')"
clusterroles_json="$(list_wildcard_objects clusterroles || echo '{}')"

roles_with_wildcards=$(echo "${roles_json}" | jq -r '
  .items[]? |
  select(.rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")) |
  "\(.metadata.namespace),\(.metadata.name)"
')

clusterroles_with_wildcards=$(echo "${clusterroles_json}" | jq -r '
  .items[]? |
  select(.rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")) |
  .metadata.name
')

if [[ -z "${roles_with_wildcards}" && -z "${clusterroles_with_wildcards}" ]]; then
  echo "No Roles or ClusterRoles with wildcard rules found."
  exit 0
fi

echo "Exporting affected Roles and ClusterRoles to ${OUTPUT_DIR} for review..."

# Export Roles
if [[ -n "${roles_with_wildcards}" ]]; then
  echo "Roles with wildcards:"
  echo "${roles_with_wildcards}" | while IFS=, read -r ns name; do
    echo "  - ${ns}/${name}"
    out="${OUTPUT_DIR}/roles/${ns}__${name}.yaml"
    kubectl get role "${name}" -n "${ns}" -o yaml > "${out}"
  done
else
  echo "No roles with wildcards."
fi

# Export ClusterRoles
if [[ -n "${clusterroles_with_wildcards}" ]]; then
  echo "ClusterRoles with wildcards:"
  echo "${clusterroles_with_wildcards}" | while read -r name; do
    [[ -z "${name}" ]] && continue
    echo "  - ${name}"
    out="${OUTPUT_DIR}/clusterroles/${name}.yaml"
    kubectl get clusterrole "${name}" -o yaml > "${out}"
  done
else
  echo "No clusterroles with wildcards."
fi

cat <<'EOF'

MANUAL REMEDIATION REQUIRED (per RBAC best practices):
- For each exported YAML in the output directory:
  * Identify any occurrence of:
      verbs: ["*"] or verbs: - "*"
      resources: ["*"] or resources: - "*"
      apiGroups: ["*"] or apiGroups: - "*"
  * Replace "*" with the minimal explicit list of verbs/resources/apiGroups
    actually required for that Role/ClusterRole.
  * Be cautious: over-restricting may break workloads; under-restricting defeats this control.

You will now be dropped into an editor, one file at a time, to make those changes.
Save and exit the editor to move to the next file.

EOF

read -r -p "Press Enter to start editing affected YAML files, or Ctrl+C to abort..."

# Edit and apply Roles
for f in "${OUTPUT_DIR}/roles/"*.yaml; do
  [[ ! -e "${f}" ]] && break
  echo "Editing Role manifest: ${f}"
  "${EDITOR_CMD}" "${f}"

  echo "Applying Role manifest: ${f}"
  kubectl apply -f "${f}"
done

# Edit and apply ClusterRoles
for f in "${OUTPUT_DIR}/clusterroles/"*.yaml; do
  [[ ! -e "${f}" ]] && break
  echo "Editing ClusterRole manifest: ${f}"
  "${EDITOR_CMD}" "${f}"

  echo "Applying ClusterRole manifest: ${f}"
  kubectl apply -f "${f}"
done

echo "Re-running wildcard audit to verify remediation..."

wildcards=$(kubectl get roles --all-namespaces -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l | tr -d ' ')

wildcards_clusterroles=$(kubectl get clusterroles -o json | jq '
  .items[] | select(
    .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
  )' | wc -l | tr -d ' ')

total=$((wildcards + wildcards_clusterroles))

if [ "${total}" -gt 0 ]; then
  echo "wildcards_present"
  echo "Remaining objects with wildcards detected: ${total}"
  echo "Re-run the script and further tighten RBAC, or manually inspect with:"
  echo "  kubectl get roles --all-namespaces -o yaml | grep -n \"- \\\"*\\\"\" -n"
  echo "  kubectl get clusterroles -o yaml | grep -n \"- \\\"*\\\"\" -n"
  exit 1
fi

echo "No remaining Roles or ClusterRoles with wildcard verbs/resources/apiGroups."
echo "Remediation for CIS GKE 4.1.3 appears complete."